Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

FEAT: Prevent self question #91

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

FEAT: Prevent self question #91

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 14 additions & 1 deletion src/modules/PublicQuestionPage/QuestionForm.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ import {
string,
} from 'valibot'

import { useAuth } from '@/components/FirebaseAuth'
// @ts-ignore
import { ShareButton } from '@/components/ShareButton'
import { Button } from '@/components/ui/button'
Expand All @@ -30,7 +31,7 @@ import {
import { Textarea } from '@/components/ui/textarea'
import { useToast } from '@/components/ui/use-toast'
import { BASEURL, patchHit, postSendQuestion } from '@/lib/api'
import { trackEvent } from '@/lib/firebase'
import { getFirebaseAuth, trackEvent } from '@/lib/firebase'
import { UserProfile } from '@/lib/types'

const schema = object({
Expand All @@ -43,8 +44,11 @@ const schema = object({

type FormValues = Output<typeof schema>

const auth = getFirebaseAuth()

export function QuestionForm({ owner }: { owner: UserProfile }) {
const { toast } = useToast()
const { isLogin, user } = useAuth(auth)
const [isLoading, setIsLoading] = useState<boolean>(false)

const form = useForm<FormValues>({
Expand Down Expand Up @@ -80,6 +84,15 @@ export function QuestionForm({ owner }: { owner: UserProfile }) {
if (process.env.NODE_ENV === 'development') {
await sendQuestion(owner?.slug || '', data.q, 'development')
} else {
if (isLogin && user?.email?.includes(owner.slug)) {
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmmm, actually user can update the slug after first login.
So detecting by matching with the email is misslead.

Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The correct one is by matching the uid.
But for the public page, I already strip the uid from the response for security purposes 😂

Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This feature seems quite hard to solve for now.

Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One approach that I can think is:

  • Passing authorization token, if user logged in
  • In the server API:
    • Get session by the token
    • Get uid from the session we get (if exist)
    • if the uid is the same with the owner of the question, you can reject it.

Seems complicated and adding at least 1 API call to the session DB

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hi sir, how about comparing slug from browser URL and slug from account info?, we can do this on file src/modules/PublicQuestionPage/QuestionForm.tsx ?

when owner of the page click Kirim Pertanyaan button, just show a dialog to tell that owner of the page cannot ask to themself

Copy link
Owner

@mazipan mazipan Oct 22, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh yes, it's possible I guess 🎉

Just can we also adding a way to submit question for our self?
In some cases, let say for testing, maybe we need that 🙈

For initial, can we enable the feature on the process.env.NODE_ENV === 'production' only? Or adding new env var NEXT_PUBLIC_ENABLE_SELF_SUBMISSSION

toast({
title: 'Preview mode:',
description: `Tidak dapat mengirimkan pertanyaan kepada diri sendiri!`,
})

return
}

// @ts-ignore
if (window?.grecaptcha) {
// @ts-ignore
Expand Down